Samba 4.25.0rc1 Released: Persistent Handles, Cluster Functional Levels, and AES-Only Domain Encryption
Samba 4.25.0rc1 has landed. The first release candidate for the next major version of the Samba file server is now available for testing. It brings experimental persistent handles for SMB3, a shift to AES-only domain encryption, and a new cluster functional level mechanism. Keep in mind that this is strictly for testing. It's not ready for production workloads.
SMB3 Persistent Handles are the headline feature. They enable Transparent Failover by persisting file handle state to durable on-disk storage. If the server restarts or crashes, clients can reconnect with valid handles. No application-level reopen required.
This matters most for virtual machine disk storage and clustered databases that can't tolerate brief file-access interruptions. You can enable it with continuous availability = yes and the global switch smb3 persistent handles = yes.
There are trade-offs. The feature forces SMB-exclusive access on the share. kernel oplocks, kernel share modes, and posix locking are all disabled. If you rely on local POSIX or NFS clients on the same share, you're out of luck. Latency will spike. Every open, update, lease, and close synchronously flushes metadata to storage. It's designed for continuous-availability workloads only. If you're not running a cluster that needs this, skip it.
Security and Clustering Improvements
The KDC defaults have shifted. kdc default domain supported enctypes now defaults to AES-only. This addresses CVE-2026-20833. Weaker encryption types are no longer negotiated for Kerberos tickets by default on domains at functional level 2008 or higher.
Clustering gets a new functional level mechanism. Think of it like AD domain functional levels. It's a cluster-wide value stored in cluster_level.tdb. New database formats and inter-node protocol changes are gated behind this level. You can raise it for controlled rolling upgrades. Samba 4.25 sets the initial level at 1.0. You can manage it with net clusterlevel. The operations are one-way. There's no downgrade path. Vendors can backport custom levels in the range 0.1–<1.0 for pre-4.25 to 4.25 migrations.
The vfs_aio_ratelimit module now enforces rate limits as a global ceiling across the cluster. A new daemon, ratelimitd, aggregates activity from all smbd processes on its node and broadcasts summaries to other nodes.
CTDB has been tidied up. Lock, PID, and socket directories now use subdirectories under your configured Samba paths. The standalone CTDB build no longer supports these options. Infrastructure host monitoring is now supported via the NETWORK MONITORING section. JSON audit log lines have been cleaned up. Leading spaces are gone. Embedded newlines are normalized to spaces. Parsers should be happier.
The Verdict
It's a dense release. The persistent handles feature is exactly what high-availability users have been asking for. The AES-only default closes a known vulnerability without requiring manual configuration. The cluster functional level makes rolling upgrades much safer.
However, the RC status means you should test thoroughly. The persistent handles trade-off for POSIX clients is significant. Plan your share configurations carefully. If you're running a mixed environment, you'll need to isolate shares carefully.
Head here to get the source. Report bugs at the official bugtracker.
